1. Technical Field
This invention relates generally to computing systems implementing encryption and decryption operations and, more particularly, to masking substitution table values in cryptographic operations.
2. Description of the Related Art
Computing systems often require operations to be carried out in a secure manner. For embedded computing devices and for pervasive systems, security of operation is often desired. To ensure that operations and communications are secure, such systems employ cryptographic methods to encrypt and decrypt data.
However, cryptographic methods are subject to attacks. One type of non-invasive attack on computing devices implementing cryptographic methods is known as a power analysis attack. A power analysis attack involves the monitoring of the power consumption of one or more components of a device while the device executes a cryptographic method. The data derived from monitoring power consumption of the device, combined with knowledge of the operations being carried out by the device, are used to derive the secret information that is part of the cryptographic method. For example, a differential power analysis (DPA) attack may target the input or the output of Substitution tables (also referred to as substitution boxes or “S-boxes”) that are common in cryptographic algorithms and are often implemented as lookup tables. The input to an S-box may include key bits and plaintext, or information derived from plaintext. In carrying out an attack to determine a key value used in a cryptographic system, an attacker controls the plaintext values and makes guesses at the key bits. Based on these guesses, computations are performed on the acquired power traces to form a set of DPA data. The DPA data with the largest peak value is used to determine which of the key bit guesses was likely correct. As will be appreciated by those skilled in the art, another type of attack is based on electromagnetic analysis of the device carrying out a cryptographic process. Although the description below references power attacks, it will be appreciated that electromagnetic analysis attacks may raise the same issues.